sssd.git/src/responder/secrets, branch sudo

SECRETS: Support 0 as unlimited for the quotas

2017-09-01T18:27:01+00:00

Add a special value for all the quota-like settings that means 'no
limit'.

Because the responder also had a global limit on the size of the
accepted body (64kiB), this patch also removes the hardcoded limit and
instead keep track of the biggest quota value on startup.

Reviewed-by: Simo Sorce 
Reviewed-by: Fabiano Fidêncio

SECRETS: Add a new option to control per-UID limits

2017-09-01T18:26:45+00:00

Adds a new option max_uid_secrets that allows to set a limit of secrets
for this particular client so that the user cannot starve other users.

Resolves:
https://pagure.io/SSSD/sssd/issue/3363

Reviewed-by: Simo Sorce 
Reviewed-by: Fabiano Fidêncio

SECRETS: Use separate quotas for /kcm and /secrets hives

2017-09-01T18:26:23+00:00

This would differentiate between out-of-capacity errors for secrets and
for KCM as they are two independent trees as far as sssd-secrets is
concerned.

The quotas for /kcm are also different in their defaults. For the /secrets
hive, we presume a large amount of small secrets. For the /kcm hive, we
presume a small amount of large secrets, because the secret is a ccache
which contains multiple credentials.

The operations are also passed in a struct quota from the local request
context instead of local_context. The quota is assigned to the request
context when the hive is selected.

Reviewed-by: Simo Sorce 
Reviewed-by: Fabiano Fidêncio

SECRETS: Rename local_db_req.basedn to local_db_req.req_dn

2017-09-01T18:26:14+00:00

This will make it possible to reuse the basedn name later for the "hive"
base DN in order to differentiate quotas for different hives.

There is no functional change in this patch.

Reviewed-by: Simo Sorce 
Reviewed-by: Fabiano Fidêncio

SECRETS: Read the quotas for cn=secrets from [secrets/secrets] configuration subsection

2017-09-01T18:26:04+00:00

This patch makes obsoletes the old way of configuring quotas for the
secrets responder. Instead, adds a new way of configuring each hive
separately in a configuration subsection, e.g.

[secrets/secrets]
max_secrets = 123

The old way is still supported as a backwards-compatible method.

Reviewed-by: Simo Sorce 
Reviewed-by: Fabiano Fidêncio

SECRETS: Store quotas in a per-hive configuration structure

2017-09-01T18:25:52+00:00

Adds two new structures to hold the quotas and associate a quota with a hive.

This is just an internal change for now, but will allow us to read quota
configuration from per-hive sections later.

Reviewed-by: Simo Sorce 
Reviewed-by: Fabiano Fidêncio

SECRETS: Do not link with c-ares

2017-09-01T18:25:37+00:00

Since we started using libcurl for the proxy provider, there is no point
in initializing or linking against c-ares.

If we want to explicitly use a resolver in the future, we should use
libcurl callbacks.

Reviewed-by: Simo Sorce 
Reviewed-by: Fabiano Fidêncio 
Reviewed-by: Lukáš Slebodník

SECRETS: Remove unused declarations

2017-09-01T18:25:22+00:00

Reviewed-by: Simo Sorce 
Reviewed-by: Fabiano Fidêncio 
Reviewed-by: Lukáš Slebodník

UTIL: Remove fcntl.h from util/util.h

2017-06-08T15:09:36+00:00

fcntl.h is not used directly by util/util.h. The header file fcntl.h
must be included in 49 files and after removing it from util.h it had to be
added only to 7 missing file which were using either directly syscall fcntl
or syscall open.

Reviewed-by: Fabiano Fidêncio

SECRETS: Fix warning Wpointer-bool-conversion

2017-05-31T13:21:29+00:00

Debug messages would always say that verify_peer and verify_host
are enabled. Even though they would be explicitly disabled.

src/responder/secrets/proxy.c:143:18: error:
    address of 'cfg->verify_peer' will always evaluate to
      'true' [-Werror,-Wpointer-bool-conversion]
          (&cfg->verify_peer ? "true" : "false"));
            ~~~~~^~~~~~~~~~~ ~
src/util/debug.h:108:32: note: expanded from macro 'DEBUG'
                     format, ##__VA_ARGS__); \
                               ^~~~~~~~~~~
src/responder/secrets/proxy.c:149:18: error:
    address of 'cfg->verify_host' will always evaluate to
      'true' [-Werror,-Wpointer-bool-conversion]
          (&cfg->verify_host ? "true" : "false"));
            ~~~~~^~~~~~~~~~~ ~
src/util/debug.h:108:32: note: expanded from macro 'DEBUG'
                     format, ##__VA_ARGS__); \
                               ^~~~~~~~~~~

Reviewed-by: Jakub Hrozek